Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240611-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    10/12/2024, 03:32 UTC

General

  • Target

    ce9e2b9e3cf464bfcbcebec013e8a59dfe109b088bbbdf2cdeecba9e5576047f.elf

  • Size

    60KB

  • MD5

    5b1f7d8968a7f58c40cf5354bbe43dd6

  • SHA1

    68a50f847c474bb21a26e4a28e4b6c024938fa44

  • SHA256

    ce9e2b9e3cf464bfcbcebec013e8a59dfe109b088bbbdf2cdeecba9e5576047f

  • SHA512

    84c3b759a51c30c7a33be0f5c62793cca3e8b91514ad3dddf3075ac9c9ee8fbffea56169bca30d7c943832834060c7009b3cfcc4850fe88dac2364d47601d885

  • SSDEEP

    1536:O7XduYshWhq/HIEy6Og3Nwz9hAy+KtLSM5Tfv83KJGTb6R4V:QdpssMPR9w4y+KtLXTX83K0Tb6R2

Malware Config

Extracted

Family

mirai

Botnet

LZRD

Signatures

  • Mirai

    Mirai is a prevalent Linux malware infecting exposed network devices.

  • Mirai family
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Writes file to system bin folder 2 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/ce9e2b9e3cf464bfcbcebec013e8a59dfe109b088bbbdf2cdeecba9e5576047f.elf
    /tmp/ce9e2b9e3cf464bfcbcebec013e8a59dfe109b088bbbdf2cdeecba9e5576047f.elf
    1⤵
    • Modifies Watchdog functionality
    • Writes file to system bin folder
    • Reads runtime system information
    PID:646

Network

    No results found
  • 64.235.45.196:3778
    967 B
    928 B
    18
    17
  • 64.235.45.196:3778
    849 B
    820 B
    16
    15
  • 188.166.213.18:19132
    432.6MB
    30837
  • 188.166.213.18:19132
    425.6MB
    30341

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.